hxxps://dz1-ggfchhgjh-ugfgxh[.]s3[.]eu-central-1[.]amazonaws[.]com/index[.]html#email@email[.]com

General

Target

https://dz1-ggfchhgjh-ugfgxh.s3.eu-central-1.amazonaws.com/index.html#[email protected]
Sample

210927-vl8x7shefq

Score

10^/10

microsoft phishing product:outlook

Malware Config

Signatures

Detected microsoft outlook phishing page
phishing microsoft product:outlook

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30913473"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "339575912"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4290354892"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B2DC727-1FB5-11EC-AF2E-D6F6AE26EDF0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4290509996"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0bda401c2b3d701	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d000000000200000000001066000000010000200000001d77a327b4135032d697f4d943a4b62421f246909fb651a8419c09e22bac6ad9000000000e80000000020000200000008dcf13ea2b46ef7816aba84dfa8273f189a7e740d624e57f4134a8d67d084a5320000000f4bbf8a3fa855e9bfa94c9aeed97e94b86d4b8d132130da3810905c16fb8d52c40000000fa0163f2ff4af2271939879d80af61d940fa3d22f07fee0ed23d8542627fdc221b669a8df1ea83720ea1220dc5468a9e03df8012523284081cc41afc2df74470	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "339527326"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30913474"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "339543920"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4293764"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007dce5df328d2b3428465887ea00eec2d00000000020000000000106600000001000020000000f94ed007f91a5ef1319704446b5fe16a13cce3bb758bcfeab94d57a258209b5e000000000e800000000200002000000044dc7eeacd48570a0168671cfb4499b6f47f81fbd574e502cfc3c9709d3e62f320000000e84fdaab4f618f3c8fa0d60abe2b1cacf58f9c7cd4682af1bfdfda96d4b88037400000006b80cde458d44dbcd700ab69d8979539adc19a44ad8896f5b65db76cc53769dd33db41579f5553e3b7b65fed7a292e991ff82b796c9b417a8db230316064bb8c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c2ab01c2b3d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30913473"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

3624 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3624 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3624 iexplore.exe
3624 iexplore.exe
4140 IEXPLORE.EXE
4140 IEXPLORE.EXE
4140 IEXPLORE.EXE
4140 IEXPLORE.EXE

pid	process
3624	iexplore.exe

pid	process
3624	iexplore.exe

pid	process
3624	iexplore.exe
3624	iexplore.exe
4140	IEXPLORE.EXE
4140	IEXPLORE.EXE
4140	IEXPLORE.EXE
4140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

iexplore.exe

description	pid	process	target process
PID 3624 wrote to memory of 4140	3624	iexplore.exe	IEXPLORE.EXE
PID 3624 wrote to memory of 4140	3624	iexplore.exe	IEXPLORE.EXE
PID 3624 wrote to memory of 4140	3624	iexplore.exe	IEXPLORE.EXE

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://dz1-ggfchhgjh-ugfgxh.s3.eu-central-1.amazonaws.com/index.html#[email protected]
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3624 CREDAT:82945 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:4140

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1E698CCB2C296D265AC1A253974E09FD_D680439EDC5966E2AEEDE8C72390D434

MD5
66bbbd3b7a62ba56e176e7a7fbcc0b2a

SHA1
3233f77b8b093feae3d6951799d46b9c25dafcae

SHA256
7253964fe79bcd766f8a8b0d800d3536fda8687a4a3b498a0a169412454392d1

SHA512
0186e1474f95c9ac4849ec3acb1ec61f8510f0110f7fe25677d7b2adef289ab85f5547110296d7c949813f076103524d0dfd8cc7b88baa769e1cfe22805dbc98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_EE9DB89C3D6A328B5FEAFF0ED3C77874

MD5
1804d32fba6725eae8ce6d9bda887051

SHA1
e09a5ddfe0090d1830619dd195bd2aa7e9bbdd09

SHA256
0450f3f6bf2159afcc7dd994d10e5a33533d884762aceb4a6d2f50a31ddb80f1

SHA512
3cf0e4b4ae6340f5413cd6de14e41bac6a4101ecc2702415005079fa412eb338604523b35b9d3e5144db6b8505fe410313e0e4ed5ab3adb3838498811f9b16c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
647b8d7bc982449272d66d17e09f119f

SHA1
fcee7e5a6ae28bbee3a7fe3ea22144b0c08f929e

SHA256
678a5f60df00580647a5434128825237050133fe3243aee397d68f4610e1b050

SHA512
21636b5a029afb2134b029db32f84a5ef0f143fbae4f377949a79cb0f453ac50dde473d1aab977d02724d7547b59d767ee03cf6f4de59deff0e81d3da90d5153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E698CCB2C296D265AC1A253974E09FD_D680439EDC5966E2AEEDE8C72390D434

MD5
7e8a2310376e1a6b8f1be6f75ad9259d

SHA1
c657144961b9a56aef90f9949ea52d4329de6774

SHA256
e0713b85eb241a55659becbc362478e6088793a6d915e55bc4ac6855592dec50

SHA512
b3958c017ebf63a3187b73e52b098a14bdb719f9b11dcc43c04833450dd8cd4c2d4b18e25cfc198325f9a183e7dea37269c504472279c952915a0cd88a81e5f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_EE9DB89C3D6A328B5FEAFF0ED3C77874

MD5
5069aa2e6966acf42e9acebbf838c3a0

SHA1
119e325932fcca1fb8c601fed06a9581cacc9768

SHA256
a7bdcf6024c6b05f8479d46305dfda9afbabd0461cc9dfb4fb8ab9db89b5fe8f

SHA512
5dd7ecfac0f7b7527704dd604ee6f5c22db6fccd2dc67d7412652e76192d2dfe98fd05472ede76fabb6924693d66ad4e09749a92284abe50eddcd56d797ba820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

MD5
986fa7eaf5481155e0d8103623d7ef2d

SHA1
9edfca5801bcbd63f0c4169e0009c351fc178bfc

SHA256
d3a22ad831fe1b61993551495e548c403b8a6da28df36e55355235fa15b8230d

SHA512
5ccd8e78a9aed07c40be813f468d6d1819b2a74ad7c350dbc5bfe18dccd5ad55db02e3d9111904966b80965fbccf11db1862a9491a9e94986082dcbdb421eb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\HHFC2LUG.cookie

MD5
db2df8bb89bcc9916cfd03882b833c7f

SHA1
d83af652b23a9b201813b9242d010b43060643fe

SHA256
cacaab342d710e0c47edb4f99c309a956f649b8f458a78dbbedff1f36210b232

SHA512
f957bbb8ed0972a12f4a032d8a0d6bd2c58948ac914b8096ce7cddb2f5b7a6e7ecb0516dd12cef1273281d09af5ff1507aa01d8926ee9b235990c12080eb5b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\MFCQYE9G.cookie

MD5
fe2ad8aada202eaa46fe137354ec083c

SHA1
09db9b0e22c31e14e3a77cd670e35d40b19f02b8

SHA256
b421c8a231683038a1ef4c17eb69a8e028d294ea008f452771885abd90297fc8

SHA512
f35de55c1e1dd81048ae9626dd9ecf736756b38c3f9b8d20d2102ab0410be63dc4c16c79656e515df695cdeed7e92951a93b4c60b6c28109e9e4f90fc33ab34f

Download Submit
memory/3624-115-0x00007FFC0B190000-0x00007FFC0B1FB000-memory.dmp

Filesize
428KB

Download
memory/4140-116-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing